Please add base64url to dependencies for use with YARN 2 packager

[JMS-1]

Describe the problem

We are using the package with yarn 2. yarn 2 will respect all dependencies and create a package bundle. When our application starts it reports a missing base64url dependency. Concerning yarn 2 this is correct: base64url is indirectly referenced through openid-client but you require it directly in your own code. This is fine for yarn 1 or npm which will recursivly project all indirect dependencies in the tree.

Generally it's a good rule to always add dependencies for each require/import and not rely on other packages.

What was the expected behavior?

Should well behave with yarn 2.

Reproduction

I hope we can go without since reason and fix are more than obvious ;-)

Environment

• package version is 2.1.0 - package.json not really change towards 2.2.0
• yarn 2 with node 14.15.4 and debian buster

[JMS-1]

FYI: after the update of openid-client to 4.2.3 this night your package fails with yarn 1 as well. The made base64url a devDependency: panva/openid-client@v4.2.2...v4.2.3

[bolmaster2]

This is also a problem with node 15 and npm 7, not just with yarn